HACKING MEDICAL DEVICES BY JENNIFER GROSS GROWTH OF MEDICAL TECHNOLOGIES • Medical technologies and computer science continue to mesh • Pacemakers • Insulin Pumps • Defibrillators • Just as susceptible to hacks and bugs as any other form of technology. BARNABY JACK • Renowned white hat hacker for McAfee • Hacked an insulin pump delivering 300 units of insulin to a mannequin in a matter of seconds. • Figured out how to hack pacemakers http://www.youtube.com/watch?v=YJ8PZe from up to 500 feet away RwweA FDA’S ROLE • Responsible for evaluating all new medical devices and risks associated with them • Seldom will examine new devices prior to them being surgically implanted unless: • Repeated malfunctions • Recalled OTHER ORGANIZATIONS INVOLVED • Center for Medicare and Medicaid Services (CMS) • Food and Drug Administration (FDA) • Department of Health and Human Services (HHS) • Department of Defense (DoD) • Department of Veterans Affairs (VA) • Department of Homeland Security (DHS) POLITICS…. • Economics behind reporting devices with defects • If a hospital were to file a report of an incident with one of the medical devices, the hospital is liable • Disincentive for notification • False sense of security • Lack of preparedness for any cyber security issues ENCRYPTION AND OTHER PROTECTIONS • All models of the various medical devices have the capability to use Advance Encryption Standard (AES) • Numerous backdoors to these devices • Backdoor could “at least have it been embedded deep inside the ICD core” LEGAL HELP? • Product Liability • Riegel v. Medtronic, Inc. PROPOSED SOLUTION • Software Freedom Law Center (SFLC) • Publicly auditable source-code OPTIONS • Use with risks of what can happen • Don’t use it at all REFERENCES • Fu, Kevin and James Blum. "Inside Risks: Controlling for Cybersecurity Risks of Medical Device Software." n.d. Computer Science Laboratory - SRI International. 20 April 2014. <http://www.csl.sri.com/users/neumann/cacm231.pdf>. • Goodin, Dan. Insulin pump hack delivers fatal dosage over the air. 27 October 2011. 20 April 2014. <http://www.theregister.co.uk/2011/10/27/fatal_insulin_pump_attack/>. • Goodman, Marc. Hacking the Human Heart. 23 August 2011. 20 April 2014. <http://bigthink.com/futurecrimes/hacking-the-human-heart>. • Kirk, Jeremy. Pacemaker hack can deliver deadly 830-volt jolt. 17 October 2012. 20 April 2014. <http://www.computerworld.com/s/article/9232477/Pacemaker_hack_can_deliver_deadly_830_volt_jolt>. • Peters, Jeff. Medical Devices: Death by Hacking and Barnaby Jack. July 2013. 20 April 2014. <http://www.hacksurfer.com/articles/medical-devices-death-by-hacking-and-barnaby-jack>. REFERENCES • Radcliffe, Jerome. "Hacking Medical Devices for Fun and Insulin: Breaking the Human SCADA System." n.d. Black Hat. 20 April 2014. <http://media.blackhat.com/bh-us11/Radcliffe/BH_US_11_Radcliffe_Hacking_Medical_Devices_WP.pdf>. • "Riegel VS. Medtronic." n.d. American Association for Justice. Web. 23 April 2014. <http://www.justice.org/cps/rde/justice/hs.xsl/2679.htm>. • Sandler, Karen, et al. "Killed By Code: Software Transparency in Implantable Medical Devices." 21 July 2010. Software Freedom Law Center. Web. 23 April 2014. • Storm, Darlene. Pacemaker hacker says worm could possibly 'commit mass murder'. 17 October 2012. 20 April 2012. <http://blogs.computerworld.com/cybercrime-andhacking/21163/pacemaker-hacker-says-worm-could-possibly-commit-mass-murder>. REFERENCES • Talbot, David. Computer Viruses Are "Rampant" on Medical Devices in Hospitals. 17 October 2012. 20 April 2014. <http://www.technologyreview.com/news/429616/computer-virusesare-rampant-on-medical-devices-in-hospitals/>. • Tobias, Marc Weber. What's to Stop Hackers From Infecting Medical Devices. 20 April 2012. 20 April 2014. <http://www.forbes.com/sites/marcwebertobias/2012/04/20/whats-tostop-hackers-from-infecting-medical-devices/>. • Ungerleider, Neal. Medical Cybercrime: The Next Frontier. n.d. 20 April 2014. <http://www.fastcompany.com/3000470/medical-cybercrime-next-frontier>. • Zetter, Kim. Board Urges Feds to Prevent Medical Device Hacking. 10 April 2012. 20 April 2014. <http://www.wired.com/2012/04/security-of-medical-devices/>.